Poracode
Run Claude, Codex, Gemini, Cursor and more AI coding agents side by side in one window, in terminal or chat, any layout.
- Source repo
- Porabuild/Poracode
- Stars
- ★ 121
- Last updated
- today
- License
- Apache-2.0
- Primary language
- TypeScript
- FA score
- 55/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformChatGPT · Claude CodeOpenAI API · Claude API (Partial support)
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A developer with both Claude Code and Codex subscriptions who wants to compare two agents on the same task in one window instead of switching terminals.
- Not a fit if
- Users who want a single-vendor agent stack and no separate CLI installs
- Teams that want a pure browser tool with no desktop installation
- Source review
- 55/100 · Major gaps
What does this agent do, and when should you use it?
Poracode is a cross-platform Electron desktop app that puts many AI coding agents — Claude, Codex, OpenCode, Gemini, Grok, Kimi Code, Qwen Code, Pi, Qoder, Factory Droid, Antigravity, Cursor, Command Code, Copilot, fx, and any agent in the ACP registry — into a single window. Threads can run CLI agents in real terminal sessions or ACP/SDK agents in a unified chat view with markdown, syntax highlighting and tool-call displays, arranged in horizontal and vertical splits. Built-in MCP servers let any agent create and steer threads, organize projects, list and merge Git worktrees, commit and sync, open and merge pull requests, schedule runs, manage skills and change settings. It also ships Crossagents for cross-provider delegation, Agent Experiments that run one prompt across agents in parallel worktrees and have an AI judge pick a winner, on-device Whisper voice input, checkpoints and rollback, a built-in browser and a Monaco editor with LSP. The same backend can run without Electron as a standalone server for desktop, browser, iOS and Android clients, and can deploy its runtime onto remote machines over SSH.
The app manages threads, each bound to a project directory and a chosen agent runtime; where a provider ships more than one runtime (for example Cursor's CLI, ACP and SDK), the user picks which one a thread uses. CLI agents run in real terminal sessions, while ACP and SDK agents render into a consistent chat interface with markdown, syntax highlighting and tool-call output. Poracode's own MCP servers expose app capabilities to any agent pointed at them, so agents can create and steer threads, organize projects, list and merge Git worktrees, commit and sync, open and merge pull requests, schedule runs, manage skills and change settings; users can also add MCP servers over stdio, HTTP or SSE. Crossagents lets one agent delegate work to another provider's agent, streaming subagent output into the parent thread. Agent Experiments runs one prompt across several agents in parallel worktrees, has an AI judge compare code and answers, then merges the winner or opens a PR. Sessions persist automatically, and checkpoints rewind a conversation to an earlier message and restore the files with it.
- A developer with both Claude Code and Codex subscriptions who wants to compare two agents on the same task in one window instead of switching terminals.
- An engineer pushing several branches in parallel across repos and Git worktrees, using project workspaces to keep dozens of threads one click apart.
- A team that wants one agent to hand subtasks to another provider's agent and keep the streamed output in the parent thread.
- A solo developer scheduling nightly reviews, dependency sweeps or changelog drafts as recurring runs.
- A researcher or operator who runs agents on a remote SSH box but drives them from a local window.
- A user who wants to follow desktop agent threads, read terminal output and get notifications from a phone.
How do you install or deploy this agent?
Download the release for your platform from the releases page or poracode.com:
# macOS: DMG (Apple silicon or Intel)
# Windows: NSIS installer (x64 or Arm64)
# Linux: AppImage or .deb (x64)
# https://github.com/Porabuild/Poracode/releasesInstall the agent CLIs you intend to use before first launch:
# Claude Code
# https://docs.anthropic.com/en/docs/claude-code
# Gemini CLI
# https://github.com/google-gemini/gemini-cli
# Codex
# https://github.com/openai/codexStandalone server installation — the version-pinned poracode launcher, release artifact, service, container, security, backup and upgrade paths — is documented in docs/STANDALONE_SERVER.md; until an npm-enabled release publishes the launcher, use the verified release artifact described there.
How do you use this agent?
- Install Poracode and launch it.
- Install the agent CLIs you want and supply your own agent subscriptions or API keys.
- Open Poracode, add your project, and start orchestrating.
# Once a thread exists:
# - pick the agent (Claude, Codex, Gemini, Cursor, ...) and its runtime (CLI / ACP / SDK)
# - arrange threads in horizontal and vertical splits and resize freely
# - install further agents from the ACP registry in settings
# - add your own MCP servers over stdio, HTTP or SSE in settingsFor remote machines, connect a server from your SSH config; Poracode installs its runtime there, then clones repos and opens threads on that machine. For the standalone server, deploy the backend per docs/STANDALONE_SERVER.md and connect desktop, browser or mobile clients to it.
What are this agent's strengths and limitations?
- Unifies a dozen-plus coding agents — including anything in the ACP registry — in one window, mixing terminal and chat panes in arbitrary splits.
- Its own MCP servers invert control: agents can drive the app itself to create threads, manage worktrees, commit, open and merge PRs, schedule runs and change settings.
- Crossagents supports cross-provider delegation with subagent output streamed into the parent thread and routing rules pinnable per task type.
- Agent Experiments runs the same prompt across parallel worktrees and has an AI judge crown a winner, which is a concrete way to compare agents.
- The same backend runs headless as a standalone server and can deploy its runtime over SSH, so desktop, browser and mobile clients share one boundary.
- Electron desktop delivery means separate DMG, NSIS, AppImage or .deb per platform; phones and browsers only reach it through remote access.
- No model quota is included: you must bring agent subscriptions or API keys and pre-install each CLI, so real capability is tied to each vendor CLI's state.
- Standalone server mode depends on the version-pinned
poracodelauncher and release artifact, with npm publishing not yet available, so upgrades and backups must follow the doc exactly. - The README offers no automated test, CI status or agent-runtime troubleshooting evidence, so operational stability is hard to verify up front.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Poracode This agent | 55 · Major gaps | Desktop appFree + model costs | ★ 121 | today | TypeScript | ChatGPT · Claude Code |
| PandaCode | 58 · Major gaps | — | ★ 1.1k | today | Rust | Codex · Claude Code · Claude.ai |
| Codeg Multi-Agent Coding Workspace | 45 · Major gaps | Desktop appFree + model costs | ★ 4.4k | 2d ago | Rust | Codex · Claude Code · OpenAI API · Claude API |
| Synara | 52 · Major gaps | Desktop appFree + model costs | ★ 2.2k | today | TypeScript | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
SECURITY.md provides a substantive remote-access threat model: loopback-only default bind, explicit acknowledgement for plaintext LAN, scope-narrowed pairing, refresh-token rotation and revocation, audit logging, Host-header gate, and ticket-gated port forwards, which evidences real least-privilege and sensitive-data design (least_privilege=2, sensitive_data_handling=2). User confirmation, however, is only hinted at (a warning before rollback when a worktree is shared); there is no described uniform confirmation flow for destructive actions such as merge, commit, PR creation, or scheduled runs, so user_confirmation=1. Data-flow transparency has architecture docs and an honest relay-MITM disclosure, but README does not state what telemetry (Sentry/PostHog) is collected, so 2. Dependency security shows many overrides, patchedDependencies, and a trustedDependencies allowlist, which is positive, but no vulnerability-scan or SBOM evidence, so 2. External effects: built-in MCP can create threads, commit, merge PRs, and schedule runs, yet README does not describe default authorization boundaries for these high-impact actions, so external_effects=1. Rollback has checkpoints with file restore and a shared-tree warning, so 2. Source attribution: LICENSE carries a copyright holder, but publisher identity is unverified and there is no NOTICE or third-party attribution, so source_attribution=1.
Self-consistency: README features align with package.json scripts, workflows, and SECURITY.md (standalone server, remote access, checkpoints) with no visible contradiction, so 2. Dependency availability: engines require node>=26.13.0, a bun canary, and several beta xterm packages, making install fragile and drift-prone, so 1. Failure messages: SECURITY.md mentions loud failure, doctor reporting, and a fixed healthz body, and workflows emit explicit errors, so 2.
Audience and scenarios are clear (parallel multi-agent use across desktop, server, mobile), so 2. Capability boundaries are documented in SECURITY.md, including what each attacker can still do and that Web/PWA clients cannot pin certificates, so 2. Trigger precision: no description of how agent invocation, MCP tools, or scheduled runs are triggered or guarded against misfire, so 1. Environment fit covers macOS/Windows/Linux/WSL/SSH/containers, so 2.
Information architecture has README sections, docs references, and a SECURITY.md matrix, so 2. Install notes include a platform table and getting-started steps, but the standalone-server install points at a launcher not yet published to npm, adding uncertainty, so 2. Naming stability: version 2.0.0 coexists with a 'version-pinned launcher' claim and canary dependencies, so 1. Examples and FAQ: only a three-step getting-started, no FAQ, so 1. Known limitations are well covered in SECURITY.md, so 2. License is the full Apache-2.0 text, so 3. Versioning/changelog is absent, so 1. Maintenance responsibility: author is Porabuild but publisher is unverified and there is no governance or support commitment, so 1.
Output usability: unified GUI, terminal, checkpoints, and PR flow give real value to multi-agent users, so 2. Marginal value comes from consolidating multiple agents with MCP orchestration, but competition is crowded and README is largely a feature list, so 2. Cost-benefit: heavy dependency footprint, bring-your-own subscriptions and API keys, and a high install bar, so 1.
claim_traceability: SECURITY.md mitigations cite commit hashes and status words, so 2. cross_source_corroboration: README claims partly align with SECURITY.md and workflows, but no tests or docs independently corroborate the feature claims, so 1. fact_inference_separation: SECURITY.md clearly separates shipped from pending and admits relay MITM and mDNS residual risk, so 2.
- Publisher identity is unverified; verify the release channel and signatures before installing.
- README does not state what Sentry/PostHog telemetry collects; confirm before deployment.
- Built-in MCP can commit, merge PRs, and schedule runs, but README does not describe default authorization or confirmation boundaries.
- Dependencies require node>=26.13.0, a bun canary, and several beta packages, creating install and reproducibility drift risk.
- The standalone-server launcher is not yet published to npm, so the install path is uncertain.
- No changelog or maintenance-responsibility statement; long-term support is unclear.